Sema: Warn on sizeof on binary ops on decayed arrays.

The array will decay into a pointer, creating an unexpected result.
sizeof(array + int) is an easy to make typo for sizeof(array) + int.

This was motivated by a NetBSD security bug, used sizeof(key - r) instead of
sizeof(key) - r, reducing entropy in a random number generator.
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/subr_cprng.c.diff?r1=1.14&r2=1.15&only_with_tag=MAIN&f=h

Differential Revision: http://llvm-reviews.chandlerc.com/D571

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178371 91177308-0d34-0410-b5e6-96231b3b80d8

3 files changed, 20 insertions, 2 deletions

diff --git a/test/Sema/expr-comma-c99.c b/test/Sema/expr-comma-c99.c
index 6e97a4fc49..02886bff05 100644
--- a/test/Sema/expr-comma-c99.c
+++ b/test/Sema/expr-comma-c99.c
@@ -1,4 +1,4 @@
-// RUN: %clang_cc1 %s -fsyntax-only -verify -std=c99
+// RUN: %clang_cc1 %s -fsyntax-only -verify -std=c99 -Wno-sizeof-array-decay
 // expected-no-diagnostics
 // rdar://6095180
 
diff --git a/test/Sema/expr-comma.c b/test/Sema/expr-comma.c
index 7902715915..e2beafe236 100644
--- a/test/Sema/expr-comma.c
+++ b/test/Sema/expr-comma.c
@@ -1,4 +1,4 @@
-// RUN: %clang_cc1 %s -fsyntax-only -verify -std=c89
+// RUN: %clang_cc1 %s -fsyntax-only -verify -std=c89 -Wno-sizeof-array-decay
 // expected-no-diagnostics
 // rdar://6095180
 
diff --git a/test/Sema/warn-sizeof-array-decay.c b/test/Sema/warn-sizeof-array-decay.c
new file mode 100644
index 0000000000..cc3ee1d0fc
--- /dev/null
+++ b/test/Sema/warn-sizeof-array-decay.c
@@ -0,0 +1,18 @@
+// RUN: %clang_cc1 -fsyntax-only -verify %s
+
+void f(int x) {
+  char foo[10];
+  int bar[20];
+  char qux[30];
+
+  (void)sizeof(bar + 10); // expected-warning{{sizeof on pointer operation will return size of 'int *' instead of 'int [20]'}}
+  (void)sizeof(foo - 20); // expected-warning{{sizeof on pointer operation will return size of 'char *' instead of 'char [10]'}}
+  (void)sizeof(bar - x); // expected-warning{{sizeof on pointer operation will return size of 'int *' instead of 'int [20]'}}
+  (void)sizeof(foo + x); // expected-warning{{sizeof on pointer operation will return size of 'char *' instead of 'char [10]'}}
+
+  // This is ptrdiff_t.
+  (void)sizeof(foo - qux); // no-warning
+
+  (void)sizeof(foo, x); // no-warning
+  (void)sizeof(x, foo); // expected-warning{{sizeof on pointer operation will return size of 'char *' instead of 'char [10]'}}
+}